Misp: Configuration Issues

[jimbolya0607]

I'm sure this is super easy.

I believe I have the files installed correctly. What I'm trying to accomplish is to run MISP from the laptop that I installed it on. I'm unsure as to what to make the config files for MISP. I've tried putting in something simple like 192.1.1.1 in the baseurl and then try that from browser but that didn't seem to work. Any help with config to get this up and running would be great.

This template is meant for bug reports, if you have a feature request, please be as descriptive as possible and delete the template

If you would like to report a bug, please fill the template bellow

Work environment

| Questions | Answers
|---------------------------|--------------------
| Type of issue | Bug, Question, Feature Request, support...
| OS version (server) | Debian, ubuntu, CentOS, RedHat, ...
| OS version (client) | XP, Seven, 10, Ubuntu, ...
| PHP version | 5.4, 5.5, 5.6, 7.0, 7.1...
| MISP version / git hash | 2.4.XX, hash of the commit
| Browser | If applicable

Expected behavior

Actual behavior

Steps to reproduce the behavior

Logs, screenshots, configuration dump, ...

[iglocska]

Can you try with localhost or 127.0.0.1?

[jimbolya0607]

yea - will try that and report back.

[jimbolya0607]

local host resolves to the apache default page "it works!"

[CheYenBzh]

Are you sure your DocumentRoot is /var/www/MISP/app/webroot in your apache conf?

Have you enable this conf with:
sudo a2dissite default-ssl
sudo a2ensite misp-ssl
sudo systemctl restart apache2

Can you copy here your apache configuration?

[jimbolya0607]

apache2.conf as follows. I guess, also keep in mind that I have thehive project on this machine as well. trying to run them both locally. thehive is also local host. I'm sure this is also part of the issue.

Mutex file:${APACHE_LOCK_DIR} default

PidFile ${APACHE_PID_FILE}

Timeout 300

KeepAlive On

MaxKeepAliveRequests 100

KeepAliveTimeout 5

User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}

HostnameLookups Off

ErrorLog ${APACHE_LOG_DIR}/error.log

LogLevel warn

IncludeOptional mods-enabled/_.load
IncludeOptional mods-enabled/_.conf

Include ports.conf

Options FollowSymLinks
AllowOverride None
Require all denied

AllowOverride None
Require all granted

Options Indexes FollowSymLinks
AllowOverride None
Require all granted

Options Indexes FollowSymLinks

AllowOverride None

Require all granted

AccessFileName .htaccess

Require all denied

LogFormat "%v:%p %h %l %u %t "%r" %>s %O "%{Referer}i" "%{User-Agent}i"" vhost_combined
LogFormat "%h %l %u %t "%r" %>s %O "%{Referer}i" "%{User-Agent}i"" combined
LogFormat "%h %l %u %t "%r" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

IncludeOptional conf-enabled/*.conf

IncludeOptional sites-enabled/*.conf

vim: syntax=apache ts=4 sw=4 sts=4 sr noet

[jimbolya0607]

Also site-misp ssl does not exist error when running those commands you sent over..

[jimbolya0607]

so i added port 9000 to ports.conf and that allows me to at least get default apache page over port 9000 now. before simply doing 127.0.0.1:9000 resulted in a connection error. I'm sure most of the configuration that needs adjusting is in the apache portion, which i have zero experience with...that's my guess at least.

[cristianbell]

Also site-misp ssl does not exist error when running those commands you sent over..

did you run sudo cp /var/www/MISP/INSTALL/apache.misp.ssl /etc/apache2/sites-available/misp-ssl.conf during the installation?

also, it can you join the MISP chat at https://gitter.im/MISP/MISP ? might be faster to chat about the issues and find a solution there.

[jimbolya0607]

So far I've been able to get this up and running...for the most part. Get internal pgp error now. Here's the commands. Don't understand why I don't have permissions on the file when I made the permissions wide open.

root@ubuntu:/etc/ssl/private# sudo -u www-data mkdir /var/www/MISP/.gnupg
root@ubuntu:/etc/ssl/private# sudo chmod 700 /var/www/MISP/.gnupg
root@ubuntu:/etc/ssl/private# sudo chmod 777 /var/www/MISP/.gnupg
root@ubuntu:/etc/ssl/private# sudo -u www-data gpg --homedir /var/www/MISP/.gnupg --g
en-key
gpg: WARNING: unsafe permissions on homedir '/var/www/MISP/.gnupg'
gpg (GnuPG) 2.1.15; Copyright (C) 2016 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

gpg: keybox '/var/www/MISP/.gnupg/pubring.kbx' created
Note: Use "gpg --full-gen-key" for a full featured key generation dialog.

GnuPG needs to construct a user ID to identify your key.

Real name: jimbo

Change (N)ame, (E)mail, or (O)kay/(Q)uit? o
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: agent_genkey failed: Permission denied
Key generation failed: Permission denied
root@ubuntu:/etc/ssl/private# sudo chmod 777 /var/www/MISP/.gnupg
root@ubuntu:/etc/ssl/private# sudo -u www-data gpg --homedir /var/www/MISP/.gnupg2 --gen-key
gpg (GnuPG) 2.1.15; Copyright (C) 2016 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

gpg: keyblock resource '/var/www/MISP/.gnupg2/pubring.kbx': No such file or directory
Note: Use "gpg --full-gen-key" for a full featured key generation dialog.

GnuPG needs to construct a user ID to identify your key.

Real name: jimbo

Change (N)ame, (E)mail, or (O)kay/(Q)uit? o
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: failed to create temporary file '/var/www/MISP/.gnupg2/.#lk0x000056224dba5230.ubuntu.4670': No such file or directory
gpg: can't connect to the agent: No such file or directory
gpg: agent_genkey failed: No agent running
Key generation failed: No agent running
root@ubuntu:/etc/ssl/private#

[jimbolya0607]

So I was able to get the gpg to work, but still getting internal error warning when going to main page. There's a link that says download the key. When you click the link it just shows the key. Can't seem to find where the error is.

[jimbolya0607]

Update:
Found some logs.

root@ubuntu:/# cd /var/www/MISP/app/tmp/logs
root@ubuntu:/var/www/MISP/app/tmp/logs# ls -alt
total 696
-rwxrwxrwx 1 www-data www-data 636030 Nov 22 11:55 debug.log
-rwxrwxrwx 1 www-data www-data 48406 Nov 22 11:55 error.log
drwsrwsrwx 2 www-data www-data 4096 Nov 22 11:35 .
-rw-r--r-- 1 www-data www-data 271 Nov 22 11:35 resque-scheduler-2016-11-22.log
-rw-r--r-- 1 www-data www-data 0 Nov 22 11:35 resque-scheduler-error.log
-rw-r--r-- 1 www-data www-data 466 Nov 22 11:35 resque-2016-11-22.log
-rw-r--r-- 1 www-data www-data 0 Nov 22 11:34 resque-worker-error.log
drwsrwsrwx 7 www-data www-data 4096 Nov 21 11:32 ..
-rwxrwxrwx 1 www-data www-data 0 Nov 21 11:32 empty
root@ubuntu:/var/www/MISP/app/tmp/logs# tail error.log

1 {main}

2016-11-22 11:55:28 Error: [MissingControllerException] Controller class JsController could not be found.
Exception Attributes: array (
'class' => 'JsController',
'plugin' => NULL,
)
Request URL: /js/misp.js
Stack Trace:

0 /var/www/MISP/app/webroot/index.php(92): Dispatcher->dispatch(Object(CakeRequest), Object(CakeResponse))

1 {main}

[cristianbell]

I think the app can not access the database but that is more of a wild guess since you only pasted the last part of the error.log.

Did you create the database user, give it permissions to the database and did you import the database from the SQL file?

Can you please check if the database, user and permissions are ok. Also check if they are set up correctly in app/Config/database.php.

And while there can you please go to app/Config/config.php and change debug to 2? should be on line 3 of config.php, 'debug' => 0, to 'debug' => 2,

After you do this you will see more debug info directly in the web gui.

[jimbolya0607]

Christian,

I scrapped the whole install and started working with one of the training .ova files. I can get to the machine and log in, but none of the machine works past that. What I mean by that is that if I click a link anywhere after I log in it just hangs. My guess is it's a network setting somewhere...possibly...

I'm sure once I get the training .ova up and work I can wipe the database and use it like a production install if I wanted to.

[iglocska]

I would rather recommend a fresh installation over using the training .ova in production (keep in mind you'd have to change all passwords, salt, etc too).

If MISP stops working after clicking links then the baseurl is set up incorrectly, simply change it to the correct value in /var/www/MISP/app/Config/config.php.

As for the error log above, that error simply shows an invalid url being accessed (/js/misp.js), the error causing it not to work is probably earlier in the same file.

[jimbolya0607]

So, it's working just fine now...the training .ova that is...
Going to work with our engineers to get a production version installed.

In the meantime, while ramping up, is there a command to purge the events in the training .ova and start with a fresh slate or no?

[iglocska]

Not directly, but you can do some cleanup via mysql.

TRUNCATE attributes;
TRUNCATE correlations;
TRUNCATE events;
TRUNCATE event_delegations;
TRUNCATE event_tags;
TRUNCATE favourite_tags;
TRUNCATE jobs;
TRUNCATE logs;
TRUNCATE posts;
TRUNCATE servers;
TRUNCATE shadow_attributes;
TRUNCATE shadow_attribute_correlations;
TRUNCATE sharing_groups;
TRUNCATE sharing_group_orgs;
TRUNCATE sharing_group_servers;
TRUNCATE sightings;
TRUNCATE threads;

This should bring you pretty close to a fresh installation - though keep in mind that you'll still have the training users / organisations present. You could clean out those tables too and start fresh - truncating the organisations and users tables and then going to the login page should generate a new default admin user / organisation that you can use (credentials: [email protected] / admin).

But again, for production I'd highly recommend a fresh installation. If you do decide to use the training VM, make sure that you:

1. set up certificates and switch to https
2. change all passwords (OS, database, MISP, etc)
3. harden the system
4. set up e-mailing and encryption

[jimbolya0607]

Cool beans. Just glad to have it up and running. There's lots I need to do with this. Will be mixing with Hive and Maltego. Training should do for now. Thanks for those sql commands. Will try that out.

Jimbo

[iglocska]

No worries, good luck and let us know if you run into any issues!

[jimbolya0607]

Will do - I was also looking on the CIRCL website. Something about trainings. Might hit that up as well.

[iglocska]

Sure, we have one coming up in Zurich early December (6th IIRC).

[adulau]

Unfortunately the training is sold out. There are still some seats for the hackathon the day after:

https://www.eventbrite.com/e/misp-hackathon-swiss-edition-tickets-28355955426

[iglocska]

Argh, my bad.

[jimbolya0607]

Is there a direct link with instructions for connecting MISP to Hive?

[RichieB2B]

I've created a wipe script to make it easy to reset a MISP installation to it's initial state (but keeping the configuration). I wrote it for the misp training VM specifically, but should work generally.
https://github.com/RichieB2B/MISP/tree/ncsc-nl/misp-wipe/tools/misp-wipe

[iglocska]

Very cool idea!

[adulau]

@RichieB2B Indeed very cool. Could you PR the misp-wipe tool? We will also add it in the VM by default.

[RichieB2B]

Will do, but I'll need to update it with the Galaxy tables first. I assume the MySQL.sql is up to date?

[RichieB2B]

Currently my wipe script does not wipe the following tables. It could (for galaxy/tags/taxonomies/warninglists), but then I'd also like to automatically populate them again from the command line. Is there an easy way to do that?

cake_sessions
galaxies
galaxy_clusters
galaxy_elements
galaxy_reference
tags
tasks
taxonomies
taxonomy_entries
taxonomy_predicates
warninglists
warninglist_entries
warninglist_types

[RichieB2B]

Currently my wipe script does not wipe the following tables. It could (for galaxy/tags/taxonomies/warninglists), but then I'd also like to automatically populate them again from the command line. Is there an easy way to do that?

cake_sessions
galaxies
galaxy_clusters
galaxy_elements
galaxy_reference
tags
tasks
taxonomies
taxonomy_entries
taxonomy_predicates
warninglists
warninglist_entries
warninglist_types